Add Document-Isolation-Policy HTTP header - #30939

WordPress uses this header to enable client-side media processing, so I am proposing it tracked here. It is also the first step toward a web-features ID that the Interop folks asked for.

Claude did the research and drafted the data, I checked it over:

Summary

Adds http.headers.Document-Isolation-Policy. The header lets a single document opt into cross-origin isolation (and so SharedArrayBuffer) without its embedder or embedded content sending COOP/COEP headers.

• Chrome 137 on desktop, 146 on Android, after an origin trial in 132-136.
• Edge, Opera and Samsung Internet are mirrored from Chrome.
• WebView is set to false, since chromestatus lists no WebView milestone.
• Firefox is set to false with impl_url pointing at the implementation bug. Mozilla's position is positive.
• Safari is set to false with impl_url pointing at the implementation bug. WebKit has not taken a standards position yet.
• experimental: true, since only one engine supports it and it has shipped for less than two years.
• No mdn_url, because there is no MDN page yet.

The isolate-and-require-corp and isolate-and-credentialless values both shipped together with the header, so they are not split into subfeatures, following Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy, which only add subfeatures for values that shipped later. Document-Isolation-Policy-Report-Only is left out of this PR because its reporting behavior hasn't been verified yet.

Test results and supporting details

• chromestatus, with the shipping milestones (desktop 137, Android 146) and origin trial dates: https://chromestatus.com/feature/5141940204208128
• Intent to ship: https://groups.google.com/a/chromium.org/d/msgid/blink-dev/67ffaf02.170a0220.1ae3c6.04ef.GAE%40google.com
• Spec: https://wicg.github.io/document-isolation-policy/#dip-header
• Firefox implementation bug: https://bugzil.la/2063367
• WebKit implementation bug: https://webkit.org/b/325516
• WebKit standards position (open): Document-Isolation-Policy WebKit/standards-positions#399
• WPT: https://wpt.fyi/results/html/document-isolation-policy

A local test page served Document-Isolation-Policy and checked self.crossOriginIsolated and typeof SharedArrayBuffer in Chrome 155 (stable). With isolate-and-require-corp and isolate-and-credentialless the page is cross-origin isolated and SharedArrayBuffer is defined. With none, or with the header absent, it is not. This confirms current behavior only, not the 137 and 146 version numbers, which come from chromestatus.

npm run lint passes.

Related issues

• Request for a web-features ID: Document Isolation Policy web-platform-tests/interop#1332 (comment)
• web-features PR: Add Document-Isolation-Policy feature web-platform-dx/web-features#4561
• Chromium tracking bug: https://issues.chromium.org/issues/333029146

AI Use

Claude Code drafted the data and this description, I steered and reviewed. I will review and test.